Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Advisories: GSA_kwCzR0hTQS1xcmc3LWhmeDctOTVjNc4AAxJC

Command injection in Git package in Wrangler

Impact

A command injection vulnerability was discovered in Wrangler's Git package affecting versions up to and including v1.0.0.

Wrangler's Git package uses the underlying Git binary present in the host OS or container image to execute Git operations. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host.

Workarounds

A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.

Patches

Patched versions include v1.0.1 and later and the backported tags - v0.7.4-security1, v0.8.5-security1 and v0.8.11.

For more information

If you have any questions or comments about this advisory:

Permalink: https://github.com/advisories/GHSA-qrg7-hfx7-95c5

Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 4 days ago
Updated: 4 days ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-qrg7-hfx7-95c5, CVE-2022-31249
References:

Affected Packages

go:github.com/rancher/wrangler
Versions: >= 0.8.6, < 0.8.11, >= 0.8.0, <= 0.8.4, <= 0.7.3
Fixed in: 0.8.11, 0.8.5-security1, 0.7.4-security1
go:rancher/github.com/rancher/wrangler
Versions: = 1.0.0
Fixed in: 1.0.1